Analysis
-
max time kernel
142s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17-05-2023 06:30
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
301KB
-
MD5
5599f89944adc8ccad21b5ab94d33381
-
SHA1
8df8ce98cdf2a8cef21e26b03841818c9d522ded
-
SHA256
0fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
-
SHA512
a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
SSDEEP
6144:BWHRhTLdCwcaYsbhO83elSyRG/1dZENASIbNjVveSvdNGf3m:BYBCwssbhOnSy3iBbNpvdk/
Malware Config
Extracted
amadey
3.69
88.218.60.230/Gb2dZz/index.php
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
oneetx.exeoneetx.exeoneetx.exeoneetx.exepid process 1524 oneetx.exe 636 oneetx.exe 1004 oneetx.exe 1604 oneetx.exe -
Loads dropped DLL 2 IoCs
Processes:
file.exepid process 1720 file.exe 1720 file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
file.exepid process 1720 file.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
file.exeoneetx.execmd.exetaskeng.exedescription pid process target process PID 1720 wrote to memory of 1524 1720 file.exe oneetx.exe PID 1720 wrote to memory of 1524 1720 file.exe oneetx.exe PID 1720 wrote to memory of 1524 1720 file.exe oneetx.exe PID 1720 wrote to memory of 1524 1720 file.exe oneetx.exe PID 1524 wrote to memory of 1168 1524 oneetx.exe schtasks.exe PID 1524 wrote to memory of 1168 1524 oneetx.exe schtasks.exe PID 1524 wrote to memory of 1168 1524 oneetx.exe schtasks.exe PID 1524 wrote to memory of 1168 1524 oneetx.exe schtasks.exe PID 1524 wrote to memory of 1272 1524 oneetx.exe cmd.exe PID 1524 wrote to memory of 1272 1524 oneetx.exe cmd.exe PID 1524 wrote to memory of 1272 1524 oneetx.exe cmd.exe PID 1524 wrote to memory of 1272 1524 oneetx.exe cmd.exe PID 1272 wrote to memory of 1664 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 1664 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 1664 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 1664 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 1248 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1248 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1248 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1248 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1768 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1768 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1768 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1768 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 1152 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 1152 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 1152 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 1152 1272 cmd.exe cmd.exe PID 1272 wrote to memory of 892 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 892 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 892 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 892 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 328 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 328 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 328 1272 cmd.exe cacls.exe PID 1272 wrote to memory of 328 1272 cmd.exe cacls.exe PID 1516 wrote to memory of 636 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 636 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 636 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 636 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1004 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1004 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1004 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1004 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1604 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1604 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1604 1516 taskeng.exe oneetx.exe PID 1516 wrote to memory of 1604 1516 taskeng.exe oneetx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\d96cb54b4a" /P "Admin:N"&&CACLS "..\d96cb54b4a" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\d96cb54b4a" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\d96cb54b4a" /P "Admin:R" /E4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {E0658B7E-28E3-46A1-8B2C-263F3EFAB71C} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeC:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeC:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeC:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
C:\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
\Users\Admin\AppData\Local\Temp\d96cb54b4a\oneetx.exeFilesize
301KB
MD55599f89944adc8ccad21b5ab94d33381
SHA18df8ce98cdf2a8cef21e26b03841818c9d522ded
SHA2560fbb43983af8733417107190f2d4a66c4d8b6b42d10a54f613d060081f36910e
SHA512a02bbfcecc55aa12ed16f5ef3db495a77be4ae328260f71a91bd93dcbba4de2f5ff9f0cc66c12e3bdc921a816aec3c1b429700f7a9024fdc2e0e901b87276171
-
memory/636-72-0x0000000000400000-0x000000000090F000-memory.dmpFilesize
5.1MB
-
memory/1004-81-0x0000000000400000-0x000000000090F000-memory.dmpFilesize
5.1MB
-
memory/1524-73-0x0000000000400000-0x000000000090F000-memory.dmpFilesize
5.1MB
-
memory/1604-90-0x0000000000400000-0x000000000090F000-memory.dmpFilesize
5.1MB
-
memory/1720-66-0x0000000000400000-0x000000000090F000-memory.dmpFilesize
5.1MB
-
memory/1720-68-0x0000000000220000-0x000000000025A000-memory.dmpFilesize
232KB